How to use security-audit-skill: install and run an AI security audit

What you need before you install

The skill needs a coding agent with a model that supports tool use and parallel sub-agents. It also needs Node.js, because the findings and coverage-ledger validators are zero-dependency Node scripts.

If you plan to let the audit execute target code such as builds, tests or fuzzers, the README says you need an OS-enforced sandbox. That sandbox must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths. Without it, the workflow keeps leads as needs_validation and does not run target code.

• A coding agent that supports tool use and parallel sub-agents
• Node.js (for the zero-dependency validators)
• An OS-enforced sandbox if you want target code executed

Install security-audit with the Skills CLI

Install the skill with the Skills CLI from the repository URL. Use the --global flag if you want a user-level installation instead of a project-level one.

Run npx skills --help to see agent-selection and non-interactive options.

Start an audit with a plain-language request

Open your coding agent in the codebase you want to audit, or point it at that codebase, and ask for a security audit. The skill activates when your request matches its trigger, such as a security audit, finding vulnerabilities or a pen-test of the code.

A direct codebase audit or pen-test request runs full audit mode. Security questions and focused vulnerability work use guidance mode unless you ask for report artifacts. In full audit mode, if you do not name an output directory, results go to ~/security-audit-skill/<repo-name>/run-<N>. The workflow writes inside the target repository only when you explicitly choose a directory that version control ignores.

• Full audit: 'security audit this codebase'
• Scoped: 'find security vulnerabilities in ./src'
• Custom output: 'do a security review, output to ~/audits/my-project'

Understand the six phases

The skill runs the audit in order. First it maps the architecture, trust boundaries and input surfaces, and builds a coverage ledger. Next, isolated hunters check ledger units while coverage critics look for gaps. Each unique candidate then goes to a fresh verifier that tries to disprove it.

The surviving records are written to findings.json and checked against report-schema.json. Fresh agents re-verify the final source claims, and material replacements get another independent verifier. The last phase derives the human-readable reports from the verified records and the ledger.

• Phase 1: Reconnaissance (architecture.md, coverage-ledger.json)
• Phase 2: Coverage-led hunting
• Phase 3: Candidate validation
• Phase 4: Structured output (findings.json)
• Phase 5: Independent record verification
• Phase 6: Reporting (REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md)

Read the findings and reports

Every finding gets one of three verdicts. confirmed means the record has a complete source trace and a bounded observed result. needs_validation means an exact fact is still unresolved, and such a record has no severity. rejected means a candidate was disproved.

Treat needs_validation items as leads, not confirmed bugs. Repeated runs on the same repo are additive: the skill reuses prior ledgers and findings to target gaps and to revalidate changed source. The README says that in its test runs a single run found roughly half of the vulnerabilities that repeated runs found in total.

• confirmed: complete source trace and bounded observed result
• needs_validation: unresolved fact, no severity
• rejected: disproved candidate
• Key output files: findings.json, REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md

Use the attack-class files for specific targets

The skill ships with separate hunting guides. ATTACK-CLASSES.md holds core, wildcard and obvious-things prompts. Other files cover specific target types, including memory safety for native code, AI and LLM targets, web protocol and auth, client-side code, supply chain and release, cloud and deployment, RPC and messaging, resource exhaustion, data isolation, and desktop, mobile and local IPC.

Check the file list in the repository to see which guides match your target before you start a narrow audit.

• ATTACK-CLASSES.md for general classes
• AI-AND-LLM.md for LLM-backed targets
• CLIENT-SIDE.md for browser code
• SUPPLY-CHAIN-AND-RELEASE.md for CI and dependencies
• CLOUD-AND-DEPLOYMENT.md for IaC and containers